servers/slapd/saslauthz.c - diff

Return to saslauthz.c CVS log

Up to [OpenLDAP] / servers / slapd

Diff for /servers/slapd/saslauthz.c between versions 1.88.2.8 and 1.88.2.13

version 1.88.2.8, 2004/01/01 18:16:34	version 1.88.2.13, 2004/04/13 22:35:20
Line 1	Line 1
/* $OpenLDAP: pkg/ldap/servers/slapd/saslauthz.c,v 1.88.2.7 2003/12/29 18:41:56 kurt Exp $ */	/* $OpenLDAP: pkg/ldap/servers/slapd/saslauthz.c,v 1.88.2.12 2004/04/12 18:20:12 kurt Exp $ */
/* This work is part of OpenLDAP Software <http://www.openldap.org/>.	/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
*	*
* Copyright 1998-2004 The OpenLDAP Foundation.	* Copyright 1998-2004 The OpenLDAP Foundation.
Line 33	Line 33
#define LDAP_X_SCOPE_REGEX ((ber_int_t) 0x0020)	#define LDAP_X_SCOPE_REGEX ((ber_int_t) 0x0020)
#define LDAP_X_SCOPE_CHILDREN ((ber_int_t) 0x0030)	#define LDAP_X_SCOPE_CHILDREN ((ber_int_t) 0x0030)
#define LDAP_X_SCOPE_SUBTREE ((ber_int_t) 0x0040)	#define LDAP_X_SCOPE_SUBTREE ((ber_int_t) 0x0040)
	#define LDAP_X_SCOPE_ONELEVEL ((ber_int_t) 0x0050)

/*	/*
* IDs in DNauthzid form can now have a type specifier, that	* IDs in DNauthzid form can now have a type specifier, that
Line 225 static int slap_parseURI( Operation *op,	Line 226 static int slap_parseURI( Operation *op,
bv.bv_val += sizeof( "subtree" ) - 1;	bv.bv_val += sizeof( "subtree" ) - 1;
*scope = LDAP_X_SCOPE_SUBTREE;	*scope = LDAP_X_SCOPE_SUBTREE;

	} else if ( !strncasecmp( bv.bv_val, "onelevel:", sizeof( "onelevel:" ) - 1 ) ) {
	bv.bv_val += sizeof( "onelevel" ) - 1;
	*scope = LDAP_X_SCOPE_ONELEVEL;

} else {	} else {
return LDAP_PROTOCOL_ERROR;	return LDAP_PROTOCOL_ERROR;
}	}
Line 244 is_dn: bv.bv_len = uri->bv_len - (bv.bv	Line 249 is_dn: bv.bv_len = uri->bv_len - (bv.bv
case LDAP_X_SCOPE_EXACT:	case LDAP_X_SCOPE_EXACT:
case LDAP_X_SCOPE_CHILDREN:	case LDAP_X_SCOPE_CHILDREN:
case LDAP_X_SCOPE_SUBTREE:	case LDAP_X_SCOPE_SUBTREE:
	case LDAP_X_SCOPE_ONELEVEL:
rc = dnNormalize( 0, NULL, NULL, &bv, nbase, op->o_tmpmemctx );	rc = dnNormalize( 0, NULL, NULL, &bv, nbase, op->o_tmpmemctx );
if( rc != LDAP_SUCCESS ) {	if( rc != LDAP_SUCCESS ) {
*scope = -1;	*scope = -1;
Line 270 is_dn: bv.bv_len = uri->bv_len - (bv.bv	Line 276 is_dn: bv.bv_len = uri->bv_len - (bv.bv
Connection c = *op->o_conn;	Connection c = *op->o_conn;
char buf[ SLAP_LDAPDN_MAXLEN ];	char buf[ SLAP_LDAPDN_MAXLEN ];
struct berval id,	struct berval id,
user = { 0, NULL },	user = BER_BVNULL,
realm = { 0, NULL },	realm = BER_BVNULL,
mech = { 0, NULL };	mech = BER_BVNULL;

if ( sizeof( buf ) <= uri->bv_len ) {	if ( sizeof( buf ) <= uri->bv_len ) {
return LDAP_INVALID_SYNTAX;	return LDAP_INVALID_SYNTAX;
Line 555 static int sasl_sc_sasl2dn( Operation *o	Line 561 static int sasl_sc_sasl2dn( Operation *o
if( ndn->bv_val ) {	if( ndn->bv_val ) {
o->o_tmpfree(ndn->bv_val, o->o_tmpmemctx);	o->o_tmpfree(ndn->bv_val, o->o_tmpmemctx);
ndn->bv_val = NULL;	ndn->bv_val = NULL;
	ndn->bv_len = 0;

#ifdef NEW_LOGGING	#ifdef NEW_LOGGING
LDAP_LOG( TRANSPORT, DETAIL1,	LDAP_LOG( TRANSPORT, DETAIL1,
Line 639 exact_match:	Line 646 exact_match:

case LDAP_X_SCOPE_CHILDREN:	case LDAP_X_SCOPE_CHILDREN:
case LDAP_X_SCOPE_SUBTREE:	case LDAP_X_SCOPE_SUBTREE:
	case LDAP_X_SCOPE_ONELEVEL:
{	{
int d = assertDN->bv_len - op.o_req_ndn.bv_len;	int d = assertDN->bv_len - op.o_req_ndn.bv_len;

Line 654 exact_match:	Line 662 exact_match:
bv.bv_val = assertDN->bv_val + d;	bv.bv_val = assertDN->bv_val + d;

if ( bv.bv_val[ -1 ] == ',' && dn_match( &op.o_req_ndn, &bv ) ) {	if ( bv.bv_val[ -1 ] == ',' && dn_match( &op.o_req_ndn, &bv ) ) {
rc = LDAP_SUCCESS;	switch ( op.oq_search.rs_scope ) {
	case LDAP_X_SCOPE_SUBTREE:
	case LDAP_X_SCOPE_CHILDREN:
	rc = LDAP_SUCCESS;
	break;

	case LDAP_X_SCOPE_ONELEVEL:
	{
	struct berval pdn;

	dnParent( assertDN, &pdn );
	/* the common portion of the DN
	* already matches, so only check
	* if parent DN of assertedDN
	* is all the pattern */
	if ( pdn.bv_len == op.o_req_ndn.bv_len ) {
	rc = LDAP_SUCCESS;
	}
	break;
	}
	default:
	/* at present, impossible */
	assert( 0 );
	}
}	}
}	}
goto CONCLUDED;	goto CONCLUDED;
Line 720 exact_match:	Line 751 exact_match:
op.o_conn = opx->o_conn;	op.o_conn = opx->o_conn;
op.o_connid = opx->o_connid;	op.o_connid = opx->o_connid;
op.o_req_dn = op.o_req_ndn;	op.o_req_dn = op.o_req_ndn;
	op.oq_search.rs_slimit = 1;
	op.oq_search.rs_tlimit = -1;

op.o_bd->be_search( &op, &rs );	op.o_bd->be_search( &op, &rs );

Line 819 void slap_sasl2dn( Operation *opx,	Line 852 void slap_sasl2dn( Operation *opx,
slap_callback cb = { NULL, sasl_sc_sasl2dn, NULL, NULL };	slap_callback cb = { NULL, sasl_sc_sasl2dn, NULL, NULL };
Operation op = {0};	Operation op = {0};
SlapReply rs = {REP_RESULT};	SlapReply rs = {REP_RESULT};
struct berval regout = { 0, NULL };	struct berval regout = BER_BVNULL;

#ifdef NEW_LOGGING	#ifdef NEW_LOGGING
LDAP_LOG( TRANSPORT, ENTRY,	LDAP_LOG( TRANSPORT, ENTRY,
Line 863 void slap_sasl2dn( Operation *opx,	Line 896 void slap_sasl2dn( Operation *opx,
case LDAP_X_SCOPE_REGEX:	case LDAP_X_SCOPE_REGEX:
case LDAP_X_SCOPE_SUBTREE:	case LDAP_X_SCOPE_SUBTREE:
case LDAP_X_SCOPE_CHILDREN:	case LDAP_X_SCOPE_CHILDREN:
	case LDAP_X_SCOPE_ONELEVEL:
/* correctly parsed, but illegal */	/* correctly parsed, but illegal */
goto FINISHED;	goto FINISHED;

case LDAP_SCOPE_ONELEVEL:	case LDAP_SCOPE_ONELEVEL:
case LDAP_SCOPE_SUBTREE:	case LDAP_SCOPE_SUBTREE:
	#ifdef LDAP_SCOPE_SUBORDINATE
	case LDAP_SCOPE_SUBORDINATE:
	#endif
/* do a search */	/* do a search */
break;	break;

Line 907 void slap_sasl2dn( Operation *opx,	Line 944 void slap_sasl2dn( Operation *opx,
#endif	#endif
op.oq_search.rs_deref = LDAP_DEREF_NEVER;	op.oq_search.rs_deref = LDAP_DEREF_NEVER;
op.oq_search.rs_slimit = 1;	op.oq_search.rs_slimit = 1;
	op.oq_search.rs_tlimit = -1;
op.oq_search.rs_attrsonly = 1;	op.oq_search.rs_attrsonly = 1;
op.o_req_dn = op.o_req_ndn;	op.o_req_dn = op.o_req_ndn;

Line 966 int slap_sasl_authorized( Operation *op,	Line 1004 int slap_sasl_authorized( Operation *op,
}	}

/* Allow the manager to authorize as any DN. */	/* Allow the manager to authorize as any DN. */
if( op->o_conn->c_authz_backend && be_isroot( op->o_conn->c_authz_backend, authcDN )) {	if( op->o_conn->c_authz_backend &&
	be_isroot_dn( op->o_conn->c_authz_backend, authcDN ))
	{
rc = LDAP_SUCCESS;	rc = LDAP_SUCCESS;
goto DONE;	goto DONE;
}	}

Removed from v.1.88.2.8
changed lines
	Added in v.1.88.2.13